tls_process: killed expiring key - hourly reconnect #2053

MrAndyBurns · 2021-11-05T14:40:46Z

MrAndyBurns
Nov 5, 2021

Hi, does anybody have any suggestions for a cause/fix for this?

Transmission appears to reconnect every hour. I'm using PureVPN and running docker on an Unraid server.

Thanks for any help or advice

Andy

This is an extract from the log
Fri Nov 5 13:53:17 2021 TLS: tls_process: killed expiring key
Fri Nov 5 13:53:20 2021 TLS: soft reset sec=0 bytes=2312772107/-1 pkts=2809274/0
Fri Nov 5 13:53:21 2021 VERIFY OK: depth=1, C=HK, ST=Central, L=HK, O=Secure-ServerCA, OU=IT, CN=Secure-ServerCA, name=Secure-ServerCA, emailAddress=[email protected]
Fri Nov 5 13:53:21 2021 VERIFY KU OK
Fri Nov 5 13:53:21 2021 Validating certificate extended key usage
Fri Nov 5 13:53:21 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Nov 5 13:53:21 2021 VERIFY EKU OK
Fri Nov 5 13:53:21 2021 VERIFY OK: depth=0, C=HK, ST=Central, L=HK, O=Secure-Server, OU=IT, CN=Secure-Server, name=changeme, emailAddress=[email protected]
Fri Nov 5 13:53:23 2021 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1552'
Fri Nov 5 13:53:23 2021 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher AES-256-GCM'
Fri Nov 5 13:53:23 2021 WARNING: 'auth' is used inconsistently, local='auth SHA1', remote='auth [null-digest]'
Fri Nov 5 13:53:23 2021 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Nov 5 13:53:23 2021 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Nov 5 13:53:23 2021 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA

Answered by haugene

Nov 8, 2021

One of the things we do to the configs in order to make them work better with a container setup is to change some ping, keepalive and inactive options in the config. The inactive config is set to one hour: https://github.com/haugene/docker-transmission-openvpn/blob/master/openvpn/modify-openvpn-config.sh#L41-L54

We do this because of reports that Docker networking becomes unstable after X amount of time (days, weeks, who knows). So the thought is that if there is no traffic through the tunnel for one hour, things might be wrong and we trigger an exit.

You could try to run with CONFIG_MOD_PING=0 and see if that solves it for you. I know I've answered the same in another thread as well so i…

View full answer

haugene · 2021-11-08T08:32:19Z

haugene
Nov 8, 2021
Maintainer

One of the things we do to the configs in order to make them work better with a container setup is to change some ping, keepalive and inactive options in the config. The inactive config is set to one hour: https://github.com/haugene/docker-transmission-openvpn/blob/master/openvpn/modify-openvpn-config.sh#L41-L54

We do this because of reports that Docker networking becomes unstable after X amount of time (days, weeks, who knows). So the thought is that if there is no traffic through the tunnel for one hour, things might be wrong and we trigger an exit.

You could try to run with CONFIG_MOD_PING=0 and see if that solves it for you. I know I've answered the same in another thread as well so if this is a recurring issue we might want to consider increasing the limit to 12 hours or something. It's more for the long-running stability I guess.

1 reply

MrAndyBurns Nov 9, 2021
Author

Hi Haugene, thanks for the reply! I'm pleased its behaving as expected and for me it is not causing any issues. I have done a basic check for leaks using ipmagnet and can not see any issues. I check speed using a test torrent (Ubuntu) and did not see any speed loss during the re-connect. Great work and thank you. I will leave as it is for the moment.

gist901 · 2021-11-08T18:40:00Z

gist901
Nov 8, 2021

Hi there,

I am seeing the same thing with my VPN connection. Thought it was with the provider. I am still seeing it occur even when there is traffic - but I do not use Transmission, I have configured other docker containers to utilize the VPN network that is created.

Mon Nov  8 11:39:09 2021 Initialization Sequence Completed
Mon Nov  8 12:39:06 2021 TLS: soft reset sec=0 bytes=396455032/-1 pkts=784492/0
Mon Nov  8 12:39:06 2021 VERIFY OK: depth=1, CN=
Mon Nov  8 12:39:06 2021 VERIFY KU OK
Mon Nov  8 12:39:06 2021 Validating certificate extended key usage
Mon Nov  8 12:39:06 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Nov  8 12:39:06 2021 VERIFY EKU OK
Mon Nov  8 12:39:06 2021 VERIFY OK: depth=0, CN=server
Mon Nov  8 12:39:07 2021 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1602', remote='link-mtu 1569'
Mon Nov  8 12:39:07 2021 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Mon Nov  8 12:39:07 2021 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Mon Nov  8 12:39:07 2021 Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Nov  8 12:39:07 2021 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 12:39:07 2021 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Nov  8 12:39:07 2021 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 12:39:08 2021 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA

It occurs exactly after an hour. Here is the end of the VPN initiating. Take note of the timestamp:

Transmission startup script complete.
Mon Nov  8 11:39:09 2021 /sbin/ip route add  via 10.0.0.1
Mon Nov  8 11:39:09 2021 /sbin/ip route add 0.0.0.0/1 via 10.35.0.90
Mon Nov  8 11:39:09 2021 /sbin/ip route add 128.0.0.0/1 via 10.35.0.90
Mon Nov  8 11:39:09 2021 /sbin/ip route add 10.35.0.1/32 via 10.35.0.90
Mon Nov  8 11:39:09 2021 Initialization Sequence Completed

2 replies

haugene Nov 8, 2021
Maintainer

Hmm. Ok. Please post your run gonfig (docker run command or docker compose) and complete logs then. At least the startup logs in addition to the reset.

gist901 Nov 8, 2021

Sure thing.

I ran it using CONFIG_MOD_PING=0 as you mentioned above and still found I had the same issue.

(I removed public IPs and volume directory)

Starting container with revision: 3358a6b25b88fc7b86e384150aaafd1091a0fed5
Creating TUN device /dev/net/tun
Using OpenVPN provider: CUSTOM
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for CUSTOM. Defaulting to external config
Downloading configs from https://github.com/haugene/vpn-configs-contrib/archive/main.zip into /tmp/tmp.e7MQiEmt2V
Extracting configs to /tmp/tmp.V0JiAgxYU9
ERROR: Could not find any configs for provider CUSTOM in downloaded configs
Cleanup: deleting /tmp/tmp.e7MQiEmt2V and /tmp/tmp.V0JiAgxYU9
No VPN configuration provided. Using default.
Modifying /etc/openvpn/custom/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Setting OpenVPN credentials...
adding route to local network 192.168.48.0/24 via 10.0.0.1 dev eth0
Mon Nov  8 13:42:21 2021 OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 19 2021
Mon Nov  8 13:42:21 2021 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Mon Nov  8 13:42:21 2021 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Nov  8 13:42:21 2021 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 13:42:21 2021 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 13:42:21 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]:1912
Mon Nov  8 13:42:21 2021 Socket Buffers: R=[180224->180224] S=[180224->180224]
Mon Nov  8 13:42:21 2021 UDP link local: (not bound)
Mon Nov  8 13:42:21 2021 UDP link remote: [AF_INET]:1912
Mon Nov  8 13:42:21 2021 TLS: Initial packet from [AF_INET]:1912, sid=665b6ee5 cfe3fd6c
Mon Nov  8 13:42:21 2021 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Nov  8 13:42:21 2021 VERIFY OK: depth=1, CN=changeme
Mon Nov  8 13:42:21 2021 VERIFY KU OK
Mon Nov  8 13:42:21 2021 Validating certificate extended key usage
Mon Nov  8 13:42:21 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Nov  8 13:42:21 2021 VERIFY EKU OK
Mon Nov  8 13:42:21 2021 VERIFY OK: depth=0, CN=server
Mon Nov  8 13:42:23 2021 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1602', remote='link-mtu 1569'
Mon Nov  8 13:42:23 2021 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Mon Nov  8 13:42:23 2021 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Mon Nov  8 13:42:23 2021 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Mon Nov  8 13:42:23 2021 [server] Peer Connection Initiated with [AF_INET]:1912
Mon Nov  8 13:42:24 2021 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Nov  8 13:42:24 2021 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.9.0.1,dhcp-option DNS 10.8.0.1,sndbuf 524288,rcvbuf 524288,route 10.35.0.1,topology net30,ping 5,ping-restart 30,compress,ifconfig 10.35.0.89 10.35.0.90,peer-id 2'
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: timers and/or timeouts modified
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: compression parms modified
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Mon Nov  8 13:42:24 2021 Socket Buffers: R=[180224->360448] S=[180224->360448]
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: --ifconfig/up options modified
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: route options modified
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: peer-id set
Mon Nov  8 13:42:24 2021 OPTIONS IMPORT: adjusting link_mtu to 1657
Mon Nov  8 13:42:24 2021 Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Nov  8 13:42:24 2021 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 13:42:24 2021 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Nov  8 13:42:24 2021 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 13:42:24 2021 ROUTE_GATEWAY 10.0.0.1/255.255.255.248 IFACE=eth0 HWADDR=02:42:0a:00:00:02
Mon Nov  8 13:42:24 2021 TUN/TAP device tun0 opened
Mon Nov  8 13:42:24 2021 TUN/TAP TX queue length set to 100
Mon Nov  8 13:42:24 2021 /sbin/ip link set dev tun0 up mtu 1500
Mon Nov  8 13:42:24 2021 /sbin/ip addr add dev tun0 local 10.35.0.89 peer 10.35.0.90
Mon Nov  8 13:42:24 2021 /etc/openvpn/tunnelUp.sh tun0 1500 1605 10.35.0.89 10.35.0.90 init
Up script executed with tun0 1500 1605 10.35.0.89 10.35.0.90 init
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.35.0.89
Updating Transmission settings.json with values from env variables
Using existing settings.json for Transmission /data/transmission-home/settings.json
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.35.0.89
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data/watch
sed'ing True to true
Enforcing ownership on transmission config directories
Applying permissions to transmission config directories
Setting owner for transmission paths to 1001:1001
Setting permissions for download and incomplete directories
2
Directories: 775
Files: 664
Setting permission for watch directory (775) and its files (664)
-------------------------------------
Transmission will run as
-------------------------------------
User name:   abc
User uid:    1001
User gid:    1001
-------------------------------------
STARTING TRANSMISSION
Transmission startup script complete.
Mon Nov  8 13:42:24 2021 /sbin/ip route add via 10.0.0.1
Mon Nov  8 13:42:24 2021 /sbin/ip route add 0.0.0.0/1 via 10.35.0.90
Mon Nov  8 13:42:24 2021 /sbin/ip route add 128.0.0.0/1 via 10.35.0.90
Mon Nov  8 13:42:24 2021 /sbin/ip route add 10.35.0.1/32 via 10.35.0.90
Mon Nov  8 13:42:24 2021 Initialization Sequence Completed
Mon Nov  8 14:42:23 2021 TLS: soft reset sec=0 bytes=299707496/-1 pkts=633183/0
Mon Nov  8 14:42:23 2021 VERIFY OK: depth=1, CN=changeme
Mon Nov  8 14:42:23 2021 VERIFY KU OK
Mon Nov  8 14:42:23 2021 Validating certificate extended key usage
Mon Nov  8 14:42:23 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Nov  8 14:42:23 2021 VERIFY EKU OK
Mon Nov  8 14:42:23 2021 VERIFY OK: depth=0, CN=server
Mon Nov  8 14:42:25 2021 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1602', remote='link-mtu 1569'
Mon Nov  8 14:42:25 2021 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Mon Nov  8 14:42:25 2021 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Mon Nov  8 14:42:25 2021 Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Nov  8 14:42:25 2021 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 14:42:25 2021 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Nov  8 14:42:25 2021 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Nov  8 14:42:25 2021 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA

Docker compose:

version: '2'

services:

  vpn:
    container_name: vpn
    image: haugene/transmission-openvpn:latest
    ports:
      - 8112:8112
      - 7878:7878
      - 9117:9117
    cap_add:
      - NET_ADMIN
    devices:
       - /dev/net/tun
    volumes:
      - /stuff/transmission:/data
      - /etc/localtime:/etc/localtime:ro
      - /stuff/openvpn/:/etc/openvpn/custom/
    environment:
      - PUID=1001
      - PGID=1001
      - OPENVPN_PROVIDER=custom
      - OPENVPN_USERNAME=
      - OPENVPN_PASSWORD=
      - WEBPROXY_ENABLED=false
      - LOCAL_NETWORK=192.168.48.0/24
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
      - CONFIG_MOD_PING=0
    restart: unless-stopped
    dns:
      - 8.8.8.8
      - 8.8.4.4
    networks:
      vpn_net:
        ipv4_address: 10.0.0.2

  deluge:
    container_name: deluge
    image: linuxserver/deluge:latest
    depends_on:
      - vpn
    environment:
      - PUID=1001
      - PGID=1001
      - UMASK=022
      - TZ=America/New_York
    volumes:
      - /stuff/deluge:/config
      - /changeme:/torrents
    network_mode: service:vpn
    restart: unless-stopped

  jackett:
    container_name: jackett
    image: linuxserver/jackett:latest
    depends_on:
      - vpn
    environment:
      - PUID=1001
      - PGID=1001
      - TZ=America/New_York
    volumes:
      - /stuff/jackett:/config
      - /changeme:/torrents
    network_mode: service:vpn
    restart: unless-stopped

  radarr:
    container_name: radarr
    image: linuxserver/radarr:arm32v7-latest
    depends_on:
      - vpn
    environment:
      - PUID=1001
      - PGID=1001
      - TZ=America/New_York
      - UMASK=022
    volumes:
      - /stuff/radarr:/config
      - /changeme/movies:/travelMovies
      - /changeme:/torrents
    network_mode: service:vpn
    restart: unless-stopped

networks:
  vpn_net:
    driver: bridge
    ipam:
     config:
       - subnet: 10.0.0.0/29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

tls_process: killed expiring key - hourly reconnect #2053

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Uh oh!

tls_process: killed expiring key - hourly reconnect #2053

Uh oh!

MrAndyBurns Nov 5, 2021

Replies: 2 comments · 3 replies

Uh oh!

haugene Nov 8, 2021 Maintainer

Uh oh!

MrAndyBurns Nov 9, 2021 Author

Uh oh!

gist901 Nov 8, 2021

Uh oh!

haugene Nov 8, 2021 Maintainer

Uh oh!

Uh oh!

gist901 Nov 8, 2021

MrAndyBurns
Nov 5, 2021

Replies: 2 comments 3 replies

haugene
Nov 8, 2021
Maintainer

MrAndyBurns Nov 9, 2021
Author

gist901
Nov 8, 2021

haugene Nov 8, 2021
Maintainer